I am working on an OTA update mechanism on an STM32N657 booting from external XSPI NOR flash (MX25UM51245G). The target is currently NUCLEO-N657X0-Q development board using the onboard MX25UM51245G XSPI NOR flash, although the final implementation will run on custom hardware. The application runs from AXISRAM after being loaded by the ST boot flow.
The OTA process receives a new firmware image and stores it in a secondary slot (Slot B) in external NOR. When the transfer is complete, OTA metadata is written and a software reset is triggered. After reboot, the application detects the pending update, copies the image from Slot B to Slot A, clears and verifies the metadata, and then triggers another software reset to boot the new image.
The copy operation appears to complete successfully. The number of bytes copied matches the image size, reads and writes return success, and spot checks at multiple offsets confirm that the data in Slot A matches Slot B after the copy. Metadata is also successfully erased, rewritten, and verified before the final reset.
What is confusing is that the first software reset works correctly and the system reboots into the OTA copy routine. However, after the Slot B to Slot A copy completes and the second software reset is issued, the board never boots the application again. This makes me wonder whether there is some STM32N6-specific requirement when rebooting after modifying external XSPI flash.
I have already tried deinitializing the XSPI peripheral, restoring clocks back to HSI, cleaning and invalidating caches, restoring RIF/RIMC attributes, and issuing MX25UM51245G reset commands before calling NVIC_SystemReset(), but the behavior remains the same.
An additional data point is that both firmware images start with the STM2 RSS header (53 54 4D 32). The Slot A image after the copy is bit-for-bit identical to Slot B at all locations checked. The new firmware image also boots correctly when programmed directly to 0x70000000 using STM32CubeProgrammer. This seems to rule out image corruption during the copy process and suggests the issue may be related to the reset or reinitialization sequence after updating the external flash.
Has anyone successfully implemented an A/B OTA scheme on STM32N657 with external XSPI NOR? Is there any special procedure required before issuing a software reset after modifying the boot image, or any known limitation of NVIC_SystemReset() when booting from external XSPI flash on STM32N6?
